Cookies and similar browser storage are small items a website saves on your device. This page lists the ones this site sets itself, who sets each, when, and how long it lasts, and says where other companies set their own. We do not run advertising cookies. How we use personal data more widely is in our Privacy Policy.
Set by our sign in system (Auth.js), as soon as a page checks whether you are signed in, which every page does, even if you never sign in: the cookies __Host-authjs.csrf-token and __Secure-authjs.callback-url. They protect the sign in form and remember where to send you after signing in. They last until you close your browser.
Set when you sign in: __Secure-authjs.session-token keeps you signed in, for up to 30 days. Signing in with Google or Facebook also sets one short lived cookie, __Secure-authjs.pkce.code_verifier, which protects that sign in and is removed within 15 minutes.
Set because you pressed a button: dnb-cookie-consent (browser storage) remembers whether you chose Necessary Only or Accept All, so we do not ask again; it stays until you clear this site's data. In the shop, the cookie dnb_shop_pass is set only after you enter the partner PIN, so the shop stays open for you for 30 days, and dnb-basket (browser storage) is saved only when you add an item to your basket and stays until you clear this site's data.
Set because you closed something: dnb-newsletter-dismissed (browser storage) is saved when you close the newsletter box or sign up, so it is not shown again, and stays until you clear this site's data. The Founding 100 pop up is switched off at the moment; if it is switched on it will save dnb-founding-popup-dismissed in the same way. These two only remember a choice you made and are not needed for the site to work.
If you pay for a membership or advertising, you are sent to Stripe's own page, which sets its own cookies under Stripe's policy. Nothing from Stripe is loaded on our pages.
Necessary Only sets nothing beyond the items above. No YouTube, SoundCloud or Apple Music player is loaded, and nothing is requested from those companies, until you press the button on a player, which is your choice for that one player. Visitor statistics stay off.
YouTube (Google): videos use YouTube's privacy enhanced player from youtube-nocookie.com. Each one loads when you press its play button, or straight away if you chose Accept All. Once loaded, YouTube may set cookies and collect data about your visit, including for advertising. We do not control this; see Google's privacy policy.
The live radio is different. Accept All does not start it; it loads only when you press the radio button. It first loads a script from www.youtube.com (YouTube's player code), which in our header check set YouTube cookies (including YSC and VISITOR_INFO1_LIVE), and then the player from youtube-nocookie.com. Pressing the radio button is therefore your choice to load YouTube.
SoundCloud: music players load from w.soundcloud.com. They load when you press Load SoundCloud player, or straight away if you chose Accept All. Once loaded, SoundCloud may set cookies and collect data about your visit. We do not control this; see SoundCloud's privacy policy.
Apple Music: a release player loads from embed.music.apple.com only when you press Play on that release, and Apple may then set cookies. Accept All does not load these.
Accept All also switches on our visitor statistics. Once you have chosen it, each page you open loads a Matomo tracker script from k4o5.co.uk, which counts visits and pages. It does not run if you choose Necessary Only or make no choice. Matomo sets its own cookies after Accept All (usually named starting _pk_). We have not inspected them on the live site and have not set Matomo to run without cookies, so they are not listed here and this page is not a complete list of them.
Fonts, photographs, cover art, video thumbnails and event posters are all delivered by our own server, so opening a page does not send your IP address to Google Fonts, Wikimedia, Unsplash, Apple, YouTube or On The Door. For a visitor who is not signed in, the only companies that handle your IP address on an ordinary visit are Cloudflare, which sits in front of our site, and our hosting provider. Cloudflare is named in our Privacy Policy. If you sign in with Google or Facebook, your profile picture is shown from the link they gave us, so Google or Facebook sees your IP address when it loads; the same can happen for other members' pictures in the Members Lounge. In our checks, a browser visit with no choice made, not signed in, set only the sign in items listed above.
To change your choice, clear this site's data in your browser settings. This signs you out and shows the cookie banner again, and you can then choose again. Cookies already set by YouTube, SoundCloud or Apple are removed through your browser's settings for those sites.
Questions? Contact us at [email protected].